Skip to content

How SQUR works

This overview explains what happens end to end, without implementation details.

The model: apps, runs and findings

  • An app (asset) is one thing you test: a web app or API at a URL. Its setup (test accounts, scope, documentation) is saved and reused.
  • A run is one pentest of that app.
  • A finding is a vulnerability SQUR found. Findings live on the app, so SQUR can tell you what is new, what is still open, what you fixed and what came back.

In the sidebar, Assets lists your apps, Findings shows every finding across them, Reports holds your reports and certificates, and Program plans how often each app should be tested.

1. You define scope and access

  • Paste the target URL under New pentest.
  • Add test accounts so SQUR tests the logged-in app, not only the public pages.
  • Run Find scope to discover other hosts the app uses, then set each to Test, Pass through or Ignore.
  • Optionally add API docs, reference URLs, documentation, a focus for the run, or source code for a whitebox pentest.
  • Confirm you are authorized to test the targets, then launch.

2. SQUR runs the pentest

  • Specialised agents plan the attack from your scope, then run reconnaissance, attacks and verification.
  • Progress and activity appear on the run page.
  • Rate limits and your scope rules keep the load on your app controlled.

3. Findings come with proof

  • Findings appear on the run page as they are confirmed.
  • Each finding has severity, the affected endpoint, a description, evidence and a suggested fix.
  • Every confirmed finding comes with proof-of-exploit. An independent verifier re-tests findings against the live app, and a finding SQUR could not confirm is marked as not confirmed.
  • Duplicates are merged to reduce noise.

4. You decide what to do

  • Mark a finding fixed, accepted risk or false positive. Your decision carries across future runs.
  • Teammates without approval rights can propose a decision, and an approver confirms it under Proposals.
  • If a repository is connected, SQUR can draft a fix as a pull request. A person reviews and merges it. SQUR never merges.

5. You re-test

  • Click Re-test on a finding after you apply a fix. No credit is used.
  • The result is recorded on the finding.

6. Reports and certificates

  • Generate an Attestation Summary or a Detailed Report per run.
  • Issue a public certificate that anyone can verify.

Safety and data handling

  • SQUR respects your configured scope and permissions.
  • See Security for defenders for allowlisting, safety checks and PII minimization.
© SQUR